﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="Debugging CSRSS"/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title>Debugging CSRSS</title>

<meta name="MS-HAID" content="t13_advanced_ca72febd-3528-4880-aba8-fed799ea20d5.xml"/>


<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(1427);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/debugging_csrss.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="debugging_windows_setup_and_the_os_loader.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="debugging_winlogon.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="debugging_techniques.htm">Debugging Techniques</A> &gt; <A href="specialized_debugging_techniques.htm">Specialized Debugging Techniques</A> &gt; </div>
	<div id="winchm_template_title">Debugging CSRSS</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>The Client Server Run-Time Subsystem (CSRSS) is the user-mode process that controls the underlying layer for the Windows environment. There are a number of problems that make it necessary to debug CSRSS itself.</p>
<p>Debugging CSRSS is also useful when the Windows subsystem terminates unexpectedly  with a <a href="#Bookmark1898"><b>Bug Check 0xC000021A</b></a> (STATUS_SYSTEM_PROCESS_TERMINATED).   In this case, debugging CSRSS will catch the failure before it gets to an "unexpected" point.</p>
<h3><a id="controlling_ntsd_from_the_kernel_debugger"></a><a id="CONTROLLING_NTSD_FROM_THE_KERNEL_DEBUGGER"></a>Controlling NTSD from the Kernel Debugger</h3>
<p>The easiest way to debug CSRSS is to use NTSD and <a href="#Bookmark1312">control it from the kernel debugger</a>.  </p>
<h3><a id="enabling_csrss_debugging"></a><a id="ENABLING_CSRSS_DEBUGGING"></a>Enabling CSRSS Debugging</h3>
<p>CSRSS debugging must be enabled before you can proceed. If the target computer is running a <i>checked build</i> of Windows, CSRSS debugging is always enabled. If the target computer is running a <i>free build</i> of Windows, you will have to enable CSRSS debugging through the Global Flags Utility (GFlags).</p>
<p>To do this, start the GFlags utility, select the <b>System Registry</b> radio button, and select <b>Enable debugging of Win32 subsystem</b>.</p>
<p>Alternatively, you can use the following GFlags command-line:</p>
<pre class="syntax" xml:space="preserve"><code>gflags /r +20000 </code></pre>
<p>Or, if you prefer, you can edit the registry key manually instead of using GFlags. Open the following registry key:</p>
<pre class="syntax" xml:space="preserve"><code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager </code></pre>
<p>Edit the <b>GlobalFlag</b> value entry (of type REG_DWORD) and set the bit 0x00020000. </p>
<p>After using GFlags or manually editing the registry, you must reboot for the changes to take effect.</p>
<h3><a id="starting_ntsd"></a><a id="STARTING_NTSD"></a>Starting NTSD</h3>
<p>Because you will be controlling the user-mode debugger from the kernel debugger, you will need to set up a kernel debugging connection. See <a href="#Bookmark6">Getting Set Up for Debugging</a> for details.</p>
<p>After the registry has been properly configured, it is a simple matter of starting NTSD as follows:</p>
<p><b>ntsd --</b></p>
<p>See <a href="#Bookmark1312">Controlling the User-Mode Debugger from the Kernel Debugger</a> for an explanation of how to proceed.</p>
<p>You will have to set your symbol path to a location on your host computer or to some other location on your network. When CSRSS is being debugged, network authentication on the target computer will not work properly.</p>
<p>Note that you may see an "in page io error" message. This is another manifestation of a hardware failure.</p>
<p>In Windows XP and later versions of Windows, when the debugging session ends, the debugger will detach from CSRSS while the CSRSS process is still running. This avoids termination of the CSRSS process itself. </p></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
